dingtalk-knowledge-search

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Runtime path read/read_url → private_markdown_with_session() → run_agent_browser(... "eval" ... "--json") ingests DingTalk web-rendered document content (including arbitrary text from the opened document) into the script, which is then returned as Markdown and fed into the agent’s LLM context.